Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Home  Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). Confidence 2013 5% Off any SANS course Use Code: SecuriTeam_5 Hack In Paris La Nuit du Hack Subjects of Interest: Vulnerability Management SQL Injection Buffer Overflows Active Network Scanning Fuzzing Fuzzer Report Network Security Network Scanner Pen Testing Security Scanner	Trillian Pro Rendezvous XMPP HTML Decoding Heap Corruption 7 May. 2007    Summary A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cerulean Studios Trillian Pro. Authentication is not required to exploit this vulnerability.   Credit: The information has been provided by Pedram Amini, TippingPoint Security Research Team. The original article can be found at: http://dvlabs.tippingpoint.com/advisory/TPTI-07-06 Free Website Security Scan Free Fuzzer Report Vulnerability Assessment Detect web app vulnerabilities University study comparing the top Accurate and automated scanning Get guidance from professionals. 6 commercially availble fuzzers. for networks of any size.    Details Protect your website! Free Trial, Nothing to install. No interruption of visitors. www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * Trillian Pro version 3.1 build 121 The specific flaw exists in the Rendezvous / XMPP (Extensible Messaging and Presence Protocol) messaging subsystem. Trillian locates nearby users through the '_presence' mDNS (multicast DNS) service on UDP port 5353. Once a user is registered through mDNS, messaging is accomplished via XMPP over TCP port 5298. Within plugins\rendezvous.dll the follow logic is applied to received messages:     4900C470 str_len:     4900C470 mov cl, [eax] ; *eax = message+1     4900C472 inc eax     4900C473 test cl, cl     4900C475 jnz short str_len     4900C477 sub eax, edx     4900C479 add eax, 128 ; strlen(message+1) + 128     4900C47E push eax     4900C47F call _malloc The string length of the the supplied message is calculated and a heap buffer in the amount of length + 128 is allocated to store a copy of the message which is then passed through expatxml.xmlComposeString(), a function called with the following prototype:     plugin_send(MYGUID, "xmlComposeString", struct xml_string_t *);     struct xml_string_t {         unsigned int struct_size;         char *string_buffer;         struct xml_tree_t *xml_tree;     }; The xmlComposeString() routine calls through to expatxml.19002420() which, among other things, HTML encodes the characters &, > and < as &, > and < respectively. This behavior can be seen in the following disassembly snippet:     19002492 push 0     19002494 push 0     19002496 push offset str_Amp ; "&"     1900249B push offset ampersand ; "&"     190024A0 push eax     190024A1 call sub_190023A0     190024A6 push 0     190024A8 push 0     190024AA push offset str_Lt ; "<"     190024AF push offset less_than ; "<"     190024B4 push eax     190024B5 call sub_190023A0     190024BA push     190024BC push     190024BE push offset str_Gt ; ">"     190024C3 push offset greater_than ; ">"     190024C8 push eax     190024C9 call sub_190023A0 As the originally calculated string length does not account for this string expansion, the following subsequent in-line memory copy operation within rendezvous.dll can trigger an exploitable memory corruption:     4900C4EC mov ecx, eax     4900C4EE shr ecx, 2     4900C4F1 rep movsd     4900C4F3 mov ecx, eax     4900C4F5 and ecx, 3     4900C4F8 rep movsb Note that binary data can be transmitted across the XMPP protocol via UTF-8 encoding. Vendor Response: Cerulean Studios has issued an update to correct this vulnerability. More details can be found at: http://blog.ceruleanstudios.com/ Disclosure Timeline: 2007.02.15 - Vulnerability reported to vendor 2007.05.02 - Digital Vaccine released to TippingPoint customers 2007.05.02 - Coordinated public release of advisory CVE Information: CVE-2007-2418  Comments: blog comments powered by Disqus	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Microsoft Visio Viewer Tree Object Type Confusion Visio File Handling Arbitrary Execution Vulnerability Microsoft Windows Modern Mail Spoofing Weakness Vulnerability Microsoft SharePoint Callback Function URL Handling Privilege Escalation Vulnerability Microsoft IE CCaret Use-after-free Arbitrary Code Execution Vulnerability Microsoft Windows 8 TrueType Font (TTF) Handling DoS Vulnerability Microsoft IE OnResize Use-After-Free Arbitrary Code Execution Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege (2013-1287) Vulnerability Microsoft IE SaveHistory Onload Event Handling Use-After-Free Arbitrary Code Execution Vulnerability Microsoft IE CMarkupBehaviorContext Use-After-Free Arbitrary Code Execution Vulnerability Microsoft SharePoint XSS Vulnerability Microsoft IE OnBeforeCopy Use-After-Free Arbitrary Code Execution Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege Escalation Vulnerability Microsoft OneNote Buffer Size Validation ONE File Handling Information Disclosure Vulnerability Microsoft IE GetMarkupPtr execCommand Print Event Handling Use-after-free Execution Vulnerability Microsoft SharePoint Remote Overflow DoS Vulnerability Microsoft IE CTreeNode Use-After-Free Arbitrary Code Execution Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege (2013-1286) Vulnerability Microsoft IE CTreeNode Use-After-Free Use-After-Free Arbitrary Execution Vulnerability Microsoft IE Proxy Server TCP Session Re-Use Cross-User Information Disclosure Weakness Vulnerability Microsoft IE Shift JIS Character Encoding Information Disclosure Vulnerability  Featured Articles Microsoft SharePoint Callback Function URL Handling Privilege Escalation Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege (2013-1287) Vulnerability Microsoft Windows USB Driver Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows Kernel Memory Object Handling Local Privilege Escalation Vulnerability Microsoft Windows SSL/TSL Forced Downgrade MitM Weakness Microsoft Windows Memory Object Handling Local Memory Privilege Escalation Vulnerability Microsoft Windows Privilege Escalation Vulnerability Microsoft .NET Framework Serialization Remote Code Execution Vulnerability Microsoft Visio Viewer VSD File Format Remote Code Execution Vulnerability Microsoft .NET Framework Input Serialization CVE-2012-0160 Remote Code Execution Vulnerability Microsoft .NET Framework ASP.NET Forms Authentication Bypass Vulnerability 'TrendMicro Control Manager CASProcessor.exe BLOB Code Execution Vulnerability' 'HP iNode Management Center iNodeMngChecker.exe Code Execution Vulnerability' 'HP Data Protector Backup Client Service EXEC_SCRIPT Code Execution Vulnerability' 'Microsoft Internet Explorer Property Change Memory Corruption Vulnerability' 'Microsoft Office PowerPoint PersistDirectoryEntry Code Execution Vulnerability' 'CA Total Defense Suite Heartbeat Web Service Code Execution Vulnerability' 'HP Web Jetadmin Unauthorized Access to Managed Resources Vulnerability' 'Novell Zenworks Handheld Management ZfHIPCnd.exe Opcode 2 Code Execution Vulnerability' 'Microsoft Windows Shell Graphics biCompression Buffer Overflow Vulnerability'
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®